0008. The runtime targets ECMA-429 and is written here

• Status: accepted
• Date: 2026-08-13

Context

0003 aimed the sandbox surface at workerd’s documented Web Standards list and delivered the thick specifications through vendored packages, whatwg-url first among them. Both halves have since been replaced. Two properties moved the target. A vendor’s list is a moving description of one competitor. ECMA-429, the Minimum common web API adopted by the Ecma General Assembly of December 2025, is a normative document that names the interfaces and defers their behaviour to the W3C and WHATWG texts, member by member. Standards can be conformed to and deviated from in writing. A vendor list can only be chased.

Vendored packages left on the strength of a measurement: 942 691 bytes of the installed runtime source were vendored against 89 320 written in this repository. Most of those bytes were Unicode tables serving paths no code inside an isolate can reach. Keeping them meant shipping a runtime that was 91 percent somebody else’s, in a product whose subject is the runtime. Staying on the workerd list was rejected because every disagreement between that list and a governing standard is unanswerable. Vendoring better packages was rejected because the measurement above is a property of vendoring, and because a runtime written elsewhere encodes another product’s bugs as behaviour here.

Decision

Inside the sandbox, the standard library targets ECMA-429, first edition, and every interface follows the W3C or WHATWG text that governs it. The product decides what gets built; the standard decides how well it is built. Runtime code is written in this repository, in JavaScript, inside the isolate. Host bridges exist only where a real privilege is needed: timers, outbound network and crypto.subtle. But those bridges carry bounds of their own, because host work sits outside the isolate’s limits.

Every divergence from a normative requirement is documented in Runtime deviations with its reason and its impact, in the form ECMA-429’s conformance clause itself requires. Where a standard leaves a detail to the implementation, message text above all, the reference runtime’s answer is matched and recorded in the compatibility inventory. Compatibility with the @cloudflare/codemode dialect remains proven by the differential suite of 0005. That suite pins the adapter, and a reference reading that contradicts a governing standard becomes an inventory row, not behaviour here.

Consequences

This repository owns every line the guest can reach, so the all-JavaScript construction becomes a property, not an accident. No native frame written here runs inside a guest call. So every allocation the guest makes lands in the metered heap, and the deadline’s interrupt reaches guest code at its back edges. The threat model rests the boundaries it lists as enforced on exactly this construction, and it states where the construction stops. A long-running V8 builtin is one of those edges. Both bounds are proven by a property suite on every run of the gate.

Conformance is now work this repository does itself. URL, encoding and structured-clone surfaces are measured against the web-platform-tests corpora, and the honest cost of the dropped Unicode tables is stated as deviation rows with their pass counts. The runtime bundle is small enough to serialize into a V8 startup snapshot. Every isolate now restores from that snapshot.

0003 is superseded. Its differential-suite half lives on in 0005. But its delivery rules, meaning the reference implementations and the verbatim workerd strings, survive only where a deviation row or the inventory records them on purpose.